The remote web server is not enforcing HSTS, as defined by RFC 6797.

[wanprince]

The ePO remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protection

[Former Member]

Hello @wanprince 

Thanks for your post.

Please refer the below KB Article:

https://kc.mcafee.com/corporate/index?page=content&id=KB93817&locale=en_US

Was my reply helpful?

If yes, please give me a Kudo.

If I have answered your query, kindly mark this as solution, so that together we help other community members.

[rackroyd]

Hi,

Please also consider this article:
KB90241 - ePolicy Orchestrator Sustaining Statement ((SSC1801301) - Missing HTTP Security headers

https://kc.mcafee.com/corporate/index?page=content&id=KB90241&locale=en_US

Kind Regards,